Package: tcc Version: 0.9.24~cvs20070502-2 Severity: normal ikiwiki creates suidable wrappers that clear the environment like this:
extern char **environ; char *newenviron[SIZE]; newenviron[0]=some_string; environ=newenviron; exec_wrapped_program(); This works fine with gcc, and AFAIK is legal. With tcc, the code runs, but the environment seen by the exec'd program remains unchanged. I've attached an actual ikiwiki wrapper program. -- System Information: Debian Release: lenny/sid APT prefers unstable APT policy: (500, 'unstable'), (500, 'testing'), (1, 'experimental') Architecture: i386 (i686) Kernel: Linux 2.6.22-3-686 (SMP w/1 CPU core) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages tcc depends on: ii libc6 2.6.1-6 GNU C Library: Shared libraries Versions of packages tcc recommends: ii libc6-dev [libc-dev] 2.6.1-6 GNU C Library: Development Librari -- no debconf information -- see shy jo
/* A wrapper for ikiwiki, can be safely made suid. */
#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
extern char **environ;
char *newenviron[8+5];
int i=0;
addenv(char *var, char *val) {
char *s=malloc(strlen(var)+1+strlen(val)+1);
if (!s)
perror("malloc");
sprintf(s, "%s=%s", var, val);
newenviron[i++]=s;
}
int main (int argc, char **argv) {
/* Sanitize environment. */
char *s;
if ((s=getenv("REMOTE_ADDR")))
addenv("REMOTE_ADDR", s);
if ((s=getenv("QUERY_STRING")))
addenv("QUERY_STRING", s);
if ((s=getenv("REQUEST_METHOD")))
addenv("REQUEST_METHOD", s);
if ((s=getenv("REQUEST_URI")))
addenv("REQUEST_URI", s);
if ((s=getenv("CONTENT_TYPE")))
addenv("CONTENT_TYPE", s);
if ((s=getenv("CONTENT_LENGTH")))
addenv("CONTENT_LENGTH", s);
if ((s=getenv("GATEWAY_INTERFACE")))
addenv("GATEWAY_INTERFACE", s);
if ((s=getenv("HTTP_COOKIE")))
addenv("HTTP_COOKIE", s);
if ((s=getenv("REMOTE_USER")))
addenv("REMOTE_USER", s);
newenviron[i++]="HOME=/home/joey";
newenviron[i++]="WRAPPED_OPTIONS=%config = ('verbose' => 0,'svnpath' => 'trunk','adminuser' => ['http://joey.kitenet.net/'],'default_pageext' => 'mdwn','locale' => undef,'underlaydirs' => [],'refresh' => 1,'atom' => 0,'usedirs' => 1,'pingurl' => [],'url' => 'http://kodama.kitenet.net/~joey','render' => undef,'historyurl' => 'http://git.kitenet.net/?p=joey/joeywiki;a=history;f=[[file]]','gitorigin_branch' => '','adminemail' => '[EMAIL PROTECTED]','templatedir' => '/usr/share/ikiwiki/templates','rebuild' => 0,'wiki_file_prune_regexps' => [qr/(?-xism:\\.\\.)/,qr/(?-xism:^\\.)/,qr/(?-xism:\\/\\.)/,qr/(?-xism:\\.x?html?$)/,qr/(?-xism:\\.ikiwiki-new$)/,qr/(?-xism:(^|\\/).svn\\/)/,qr/(?-xism:.arch-ids\\/)/,qr/(?-xism:{arch}\\/)/,qr/(?-xism:(^|\\/)_MTN\\/)/,qr/(?-xism:\\.dpkg-tmp$)/,qr/(?-xism:favicon.ico)/],'wrappers' => 1,'timeformat' => '%a, %d %b %Y %H:%M:%S %z','cgi' => 1,'userdir' => '','wikistatedir' => '/home/joey/src/joeywiki/.ikiwiki','mirrorlist' => {'kite' => 'http://kitenet.net/~joey'},'account_creation_password' => '','libdir' => undef,'diffurl' => 'http://git.kitenet.net/?p=joey/joeywiki;a=blobdiff;h=[[sha1_to]];hp=[[sha1_from]];hb=[[sha1_parent]];f=[[file]]','w3mmode' => 0,'destdir' => '/home/joey/html','wiki_link_regexp' => qr/(?x-ism:\n \\[\\[ # beginning of link\n (?:\n ([^\\]\\|\\n\\s]+) # 1: link text\n \\| # followed by '|'\n )? # optional\n \n ([^\\s\\]#]+) # 2: page to link to\n (?:\n \\# # '#', beginning of anchor\n ([^\\s\\]]+) # 3: anchor text\n )? # optional\n \n \\]\\] # end of link\n )/,'sslcookie' => 0,'svnrepo' => undef,'gitmaster_branch' => 'master','httpauth' => 0,'web_commit_regexp' => qr/(?-xism:^web commit (by (.*?(?=: |$))|from (\\d+\\.\\d+\\.\\d+\\.\\d+)):?(.*))/,'getctime' => 0,'cgiurl' => 'http://kodama.kitenet.net/~joey/ikiwiki.cgi','wiki_file_regexp' => qr/(?-xism:(^[-[:alnum:]_.:\\/+]+$))/,'disable_plugins' => ['passwordauth'],'openidsignup' => 'https://www.myopenid.com/affiliate_signup?affiliate_id=28','underlaydir' => '/usr/share/ikiwiki/basewiki','notify' => 0,'discussion' => 1,'plugin' => ['mdwn','inline','htmlscrubber','passwordauth','openid','signinedit','lockedit','conditional','goodstuff','polygen','fortune','openid','poll','aggregate','html','prettydate','sparkline','postsparkline','teximg','mirrorlist','anonok'],'post_commit' => 0,'wikiname' => 'joey','srcdir' => '/home/joey/src/joeywiki','syslog' => 0,'numbacklinks' => 10,'rss' => 1,'htmlext' => 'html','exclude' => $config{'wiki_file_prune_regexps'}[10],'rcs' => 'git','wrappermode' => '6755');";
newenviron[i]=NULL;
environ=newenviron;
if (setregid(getegid(), -1) != 0 || setreuid(geteuid(), -1) != 0) {
perror("failed to drop real uid/gid");
exit(1);
}
execl("/usr/bin/ikiwiki", "/usr/bin/ikiwiki", NULL);
perror("exec /usr/bin/ikiwiki");
exit(1);
}
signature.asc
Description: Digital signature
